UNSOLVED
C
c_brookhart
59 Posts
0
6587
February 4th, 2005 07:00
virus question
A couple of days ago while browsing to a web site, Norton Anti-Virus auto protect displayed a warning that a virus had been detected. I did not get to see the full name of the file that supposedly had a virus, but I did see that it was an html file. Is this most likely a temporary internet file that got infected? Anyway, after acknowledging the virus alert, Norton then displayed an alert that access to the file was denied. When I clicked OK, the same message came up again. After clicking OK again, Norton displayed an alert that said the file had been deleted. The virus in question was the W32.Sasser virus. I previously had this virus on the system despite having auto protect enabled and was having windows shut down by itself. I downloaded the removal tool from Symantec and got rid of the virus. After seeing that the same virus had infected a file on the computer, I downloaded the removal tool and ran it twice and nothing was found on the system.
How can I get a virus by doing nothing more than browsing to a webpage? Is there some kind of hidden code on the page that would cause a virus to be transmitted to the system? How do I know for sure that this virus is in fact out of windows and won't do anymore harm?
192
0
Posted February 4th, 2005 10:00
Whichever virus was detected will be noted in the local Activity Log for Norton Anti Virus. While the procedure for viewing same may vary somewhat depending on which version you have, the common method for reviewing the log is to double click the NAV icon in the system tray, and choose Reports - Activity Log - Virus Alerts (applies to NAV 2003). Once there, you should be able to locate the specific threat. (FYI, there are several variations of the Sasser virus, so it helps to know which specific one you encountered.) From there, I'd recommend going to Symantec's site and reviewing the available information on the virus that was detected, with special attention paid to the tips for avoiding same. For example - is your firewall enabled? Are all Critical Updates from MS (including Service Pack 2) installed? Is Automatic Update enabled on Norton Anti Virus? Do you run regular system scans for virus activity?
Any time you see something like this happen, you should take steps to ensure that you're doing your part toward preventing such occurrences. Note the address of the affected web site, and report what happened to the site operator. Make sure your system is up to date. Don't be satisfied with the minimum attempts to get the local alert to go away. Find out why this happened, what it was, and how to prevent it from happening in the future. The tools for accomplishing this are right there in front of you.
192
0
Posted February 4th, 2005 10:00
Search for the cwshredder1591 on the internett and download it. It detects spyware easy, fast and removes it from your computer...in my case it works better than Norton....192
0
Posted February 4th, 2005 21:00
In looking at the activity log for viruses in Norton Anti-Virus 2003, there are quite a few viruses listed. Some have a status of deleted, some have a status of repair failed and others have a status of access denied. When I had dial-up internet, I used the internet connection firewall in windows. When I switched to high speed internet, I installed McAfee firewall. I had Norton Anti-virus auto update enabled, but the problem is that when the auto update is enabled it seems to use up all the system resources so I basically can't use the computer until the auto update complete message appeared in the system tray. I now manually update Norton Anti-Virus once a week. The most recent virus was the W32.Sasser.Worm. I don't have XP SP2 installed. If I do install SP2 does is it necessary to do a clean install of windows by reformatting and then installing SP1, getting all updates, and then installing SP2?192
0
Posted February 4th, 2005 22:00
1. If you're coming into contact with that many viruses, you're doing something wrong - either accepting e-mail from parties with infected systems, or visiting the wrong web sites, or a combination of both, and perhaps more. If there's a question about which alert occurred at which time though, the log should show details about that (see image below, from Nav 2003). A combination of that, your Internet History, and perhaps some note taking on your part when this sort of unusual activity occurs should be all that's necessary to allow you to either adjust your surfing habits or start blocking senders who routinely e-mail viruses, and I'd recommend doing both.2. Regarding the firewall situation, the Windows XP firewall is more than adequate for most users. I think I'd be losing that McAfee stuff like a bad habit, and sticking with XP's firewall, which, good as it was under SP-1 is even better with SP-2. Not only does it use less resources, but it's easier to configure for average use. That current firewall could be part of what's making Live Update bog your system down so much. With the type and quantity of virus activity you're experiencing, you should have Automatic Live Update enabled all the time. I have it configured that way on a PIII Optiplex with a 500 mhz processor, and I never even notice that it's running until I get the "All done" popup.3. You should install Service Pack 2 as soon as possible. Under most circumstances, it's not necessary to start from scratch to get it installed, although if your system is hosed from all those viruses, it may be easier that way. In any event, you need to get it installed. It's a Critical Update for Windows XP, and should be treated as such.http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.worm.html Details - W32.Sasser.Worm There's no reason for anyone to be having problems with this, if their system is configured and maintained properly. It's been identified and addressed by Symantec since April 30, 2004 - most other AV vendors released patches at about the same time.You might want to check your Quarantine file in NAV and delete anything in there currently. That might make it a bit easier to see what's going on when something occurs.192
0
Posted February 5th, 2005 00:00
I took care of the Sasser virus the first time it showed up. I downloaded and ran the removal tool from Symantec. I downloaded it and ran it again when the virus showed up a couple of days ago.I notice that live update is running because I have to first log on to windows to even get live update to run on its own. Once I log on, I can't get to the start menu, access e-mail, or the internet, or do anything else until the message is displayed that live update is complete. I never open e-mail attachments from sources that I don't know. A look in the quarrentine items log shows 58 items. The majority of these came from e-mail. I have Norton configured to scan every incoming e-mail for viruses. A few months ago, I started receiving messages from Microsoft in the html format about critical updates that needed to be applied. The messages all had viruses attached to them and Norton deleted them. I am aware of a new scam call "phishing" and I know that the messages that appeared to be coming from Microsoft were actually viruses. I always just left them alone and never clicked any of the links.
BrickYard
2 Intern
•
501 Posts
192
0
Posted February 4th, 2005 07:00